kernel: inet: frags: strip GSO state from fragments before reassembly

A flaw was found in the Linux kernel's network fragment reassembly process. An unprivileged local user, or a guest in a virtualized environment, could craft specially formed IPv4 or IPv6 network fragments that incorrectly retain Generic Segmentation Offload GSO state after reassembly. This...

kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial o...

kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

K000163826: Linux kernel vulnerabilities CVE-2026-46164 and CVE-2026-46165

Security Advisory Description CVE-2026-46164 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in createspaceinfosubgroup error path When kobjectinitandadd fails, the call chain is: createspaceinfosubgroup - btrfssysfsaddspaceinfotype - kobjectinitandadd -...

CVE-2026-98647

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the kernel. When loading a specially crafted BPF program that accesses a structure with an empty flexible array member, the verifier...

CVE-2026-98646

A flaw was found in the Linux kernel's TCP subsystem. A local user running Berkeley Packet Filter BPF programs can cause a Denial of Service DoS by crashing the system. This issue occurs when destroying a listening TCP socket with pending connection requests, mistakenly invoking a sleeping...

CVE-2026-98643

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This flaw can lead to information disclosure when a BPF socket operations program reads the round-trip time rttmin field during TCP connection handling. Because the kernel fails to verify the socket type before casting i...

CVE-2026-98645

A flaw was found in the Linux kernel's Winwing Human Interface Device HID driver. The driver improperly manages memory when releasing force-feedback resources, leading to an invalid memory release and subsequent double free. A local user could trigger this flaw during device disconnection, driver...

CVE-2026-98644

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local user could cause a Denial of Service DoS by executing batch lookup or deletion operations on large hash maps. Due to a missing rescheduling check when traversing consecutive empty hash table entries, the kernel c...

kernel: ipv4: validate checksum_start before completing checksum

A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during...

CVE-2026-98641

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem on ARM64 architectures. When processing BPF exception callbacks, the compiler fails to properly set up the stack frame pointer register. A local user can exploit this vulnerability by running a crafted BPF program that...

CVE-2026-98640

A flaw was found in the Linux kernel's AMD Sensor Fusion Hub amdsfh driver. An attacker capable of attaching or emulating a crafted Peripheral Component Interconnect PCI device can cause a Denial of Service DoS through a system crash. This issue occurs because the driver fails to validate the PCI...

CLSA-2025-1754037492 Fix CVE(s): CVE-2025-21760, CVE-2025-21761, CVE-2025-21762, CVE-2025-21764

Ubuntu: 4.15.0-250.261 Focal update: v5.4.291 upstream stable release LP: 2106002 // CVE-2025-21760 // CVE-url: https://ubuntu.com/security/CVE-2025-21760 - ndisc: extend RCU protection in ndiscsendskb Focal update: v5.4.291 upstream stable release LP: 2106002 // CVE-2025-21761 // CVE-url:...

CVE-2026-90012

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI subsystem. When handling Direct Memory Access DMA mappings, an issue arises if a receive RX mapping fails after a transmit TX mapping succeeds, or if a TX mapping fails during a subsequent transfer. This can lead to incorrect...

CVE-2026-98636

A flaw was found in the SquashFS file system implementation in the Linux kernel. A local user could exploit this vulnerability by mounting a specially crafted SquashFS image with an invalid dictionary size. Processing this image triggers an invalid shift operation, leading to a kernel crash and...

CVE-2026-98637

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64. When a virtual CPU vCPU fails to initialize Scalable Vector Extension SVE support, feature flags are improperly handled, leaving subsequent vCPUs in an inconsistent state without allocated memory. A guest...

CVE-2026-80752

A flaw was found in the Linux kernel's psxpad-spi driver. This vulnerability occurs because the psxpadspisuspend function attempts to access controller state before it has been properly initialized, leading to a null pointer dereference. A local attacker could exploit this to cause a system crash...

CVE-2026-80743

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture System on Chip ASoC xilinx formatterpcm component. This vulnerability arises when interrupt request IRQ handlers attempt to access driver data before it has been fully initialized during device setup. An interrupt occurring ...

CVE-2026-98638

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem on ARM64 systems. This vulnerability can lead to a Denial of Service DoS by causing a fatal hypervisor crash. The Protected KVM pKVM hypervisor does not properly validate the Scalable Vector Extension SVE vector...

K000163825: Linux kernel vulnerabilities CVE-2026-46110 and CVE-2026-46115

Security Advisory Description CVE-2026-46110 In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them a...